CVE-2026-15318

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-15318

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15318.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-15318

Published

2026-07-10T01:30:09.422Z

Modified

2026-07-15T01:48:50.072659621Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

Sipeed PicoClaw MQTT Channel mqtt.go authorization

Details

A weakness has been identified in Sipeed PicoClaw up to 0.2.9. Affected by this issue is some unknown functionality of the file pkg/channels/mqtt/mqtt.go of the component MQTT Channel Handler. This manipulation of the argument client_id causes incorrect authorization. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The reported GitHub issue was closed automatically due to inactivity.

Database specific

{
    "cwe_ids": [
        "CWE-285",
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15318.json",
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/sipeed/picoclaw

Affected ranges

Type

GIT

Repo

https://github.com/sipeed/picoclaw

Events

Introduced

8207c1c7e6006c0664dfec99fd6bbbda34d2550a

Last affected

2992eccbf03e54258a6889cf19a5a4fe6255895f

Database specific

{
    "extracted_events": [
        {
            "introduced": "0.2.0"
        },
        {
            "last_affected": "0.2.0"
        },
        {
            "introduced": "0.2.1"
        },
        {
            "last_affected": "0.2.1"
        },
        {
            "introduced": "0.2.2"
        },
        {
            "last_affected": "0.2.2"
        },
        {
            "introduced": "0.2.3"
        },
        {
            "last_affected": "0.2.3"
        },
        {
            "introduced": "0.2.4"
        },
        {
            "last_affected": "0.2.4"
        },
        {
            "introduced": "0.2.5"
        },
        {
            "last_affected": "0.2.5"
        },
        {
            "introduced": "0.2.6"
        },
        {
            "last_affected": "0.2.6"
        },
        {
            "introduced": "0.2.7"
        },
        {
            "last_affected": "0.2.7"
        },
        {
            "introduced": "0.2.8"
        },
        {
            "last_affected": "0.2.8"
        },
        {
            "introduced": "0.2.9"
        },
        {
            "last_affected": "0.2.9"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*

0.2.0

0.2.1

0.2.2

0.2.3

0.2.4

0.2.5

0.2.6

0.2.7

0.2.8

0.2.9

v0.*

v0.2.0

v0.2.1

v0.2.2

v0.2.2-nightly.20260312.6612ca09

v0.2.3

v0.2.4

v0.2.5

v0.2.6

v0.2.7

v0.2.8

v0.2.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15318.json"